Mode-pairing quantum key distribution

Quantum key distribution — the establishment of information-theoretically secure keys based on quantum physics — is mainly limited by its practical performance, which is characterised by the dependence of the key rate on the channel transmittance R(η). Recently, schemes based on single-photon interference have been proposed to improve the key rate to \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$R=O(\sqrt{\eta })$$\end{document}R=O(η) by overcoming the point-to-point secret key capacity bound with interferometers. Unfortunately, all of these schemes require challenging global phase locking to realise a stable long-arm single-photon interferometer with a precision of approximately 100 nm over fibres that are hundreds of kilometres long. Aiming to address this problem, we propose a mode-pairing measurement-device-independent quantum key distribution scheme in which the encoded key bits and bases are determined during data post-processing. Using conventional second-order interference, this scheme can achieve a key rate of \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$R=O(\sqrt{\eta })$$\end{document}R=O(η) without global phase locking when the local phase fluctuation is mild. We expect this high-performance scheme to be ready-to-implement with off-the-shelf optical devices.


Supplementary Note 1. SOURCE REPLACEMENT OF THE RANDOM PHASE SYSTEMS
In the security proof of the coherent-state QKD schemes, we will frequently come across the photon-number measurement on the coherent states with randomised phases. Using the overall photon-number measurement on two optical modes, one can post-select the single-photon component as an ideal encoding qubit. A unique feature of the MP scheme is that, Alice and Bob do not want to decide which two optical modes to perform the overall photonnumber measurement before obtaining the detection result from the untrusted party, Charlie. To analyze the security of the MP scheme in this scenario, we perform an extra source-replacement procedure by introducing extra ancillary systems to record the random phase or photon number information. In this way, we can realize the overall photon-number measurement of the coherent states indirectly based on the measurement on the ancillary systems.
For the convenience of later discussion, here, we introduce the source-replacement procedure of the random phases in detail. First, we consider the source replacement of the encoded random phase in a single optical mode in Supplementary Note 1 A. With the Fourier transform on the ancillary basis, we then show the complementarity between encoded phases and photon numbers. After that, we describe the source replacement of the encoded random phases in the two-optical-mode case in Supplementary Note 1 B. We will show the compatibility of the relative-phase measurement and the overall photon-number measurement.
A. Single-optical-mode case Consider a coherent state | √ µe iφ on system A with a random phase φ. For the convenience of later discussion, we assume that the phase φ is discretely randomised from the set {φ j = 2π D j} j∈ [D] . Here, D is the number of discrete phases and [D] := {0, 1, ..., D − 1}. In the source replacement, we introduce a qudit with d = D to record the random phase information. The joint purified system can be written as This purified state can be prepared by first preparing a coherent state | √ µ A and a maximal coherent qudit state and then applying a controlled-phase gate C D -Û (φ ∆ ) with φ ∆ := 2π D from the quditÃ to the optical mode A. The controlled-phase gate is defined as where a † and a are the creation and annihilation operators of the mode A, respectively.
To define the measurement on the ancillaryÃ that informs the photon number of A, we introduce a complementary basis  In this way, the state in Eq. (1) can be reformulated as where the normalized pseudo-Fock state is given by, and the corresponding probability distribution is, From Eq. (5) we can see that, the global phase φ j and the (pesudo) photon number k are two complementary observables, which cannot be determined simultaneously. Furthermore, since the normalized pesudo-Fock states {|λ µ (k) A } k are orthogonal with each other, if we measure the ancillary systemÃ on the basis {|k }, it is equivalent to perform the projective (pesudo) photon-number measurement on the system A.

B. Two-optical-mode case
In the coherent-state MDI-QKD scheme, usually we encode the information into the single-photon subspace on two orthogonal optical modes. To see how this works, we consider the two-optical-mode encoding and show the compatibility between the global photon number and the relative-phase measurement.
Consider two coherent states | √ µe iφ1 A1 and | √ µe iφ2 A2 on two orthogonal optical modes with random phases φ 1 and φ 2 . Similarly, we assume the random phases are discretely randomised from the sets {φ j1 = 2π D j 1 } D−1 j1=0 and {φ j2 = 2π D j 2 } D−1 j2=0 , respectively. The joint purified system can be written as, where we substitute the variable j 1 := j 2 + j θ . The addition + for all the discrete indices (j 1 , j 2 and j θ ) is defined on the ring Z D (taking modulus of D). (a) Two coherent states with independent random phases φj 1 and φj 2 . (b) A possible way to produce the entangled state generated by the source replacement on the coherent states with random phase encoding. Alice first prepares two maximal coherent qudit state |+D on the systemsÃ1 andÃ2, then performs the control gates CD −Û (φ∆) fromÃ1 and A2 to A1 and A2, respectively, to generate the state |ψ1,2 . When Alice performs the joint measurement M (k, θ) defined in Eq. (13) onÃ1 andÃ2, she can obtain the global photon number k as well as the relative phase information θ on systems A1 and A2.
For each given θ, the basis vectors {|j 2 + j θ Ã 1 |j 2 Ã 2 } D−1 j2=0 defines a subspace on the joint Hilbert space of two quditsÃ 1 andÃ 2 . Similar to Eq. (4), we introduce a partial Fourier transform on each subspace, ∀k, j 2 ∈ [D], |k, j θ Ã 1,Ã2 := 1 √ D D−1 j2=0 e i 2π D j2k |j 2 + j θ Ã 1 |j 2 Ã 2 , In this way, the state in Eq. (8) can be reformulated as where in the second equality, we use the partial Fourier transform in Eq. (9). In the fourth equality, we simplify the expression by a phase-gateÛ A1 (φ) := e iφa † 1 a1 and the 50:50 beam-splitterBS with the following transformation relationship, where a 1 and a 2 denote the annihilation operators of the two input modes, while a 1 and a 2 denote the annihilation operators of the two output modes. In the fifth equality, we define |λ 2µ 1,2 (k), j θ A1A2 : = to be a normalized state with pseudo-Fock number k and relative phase θ = 2π D j θ . From Eq. (10) we can see that, the overall (pseudo) photon number k and the (discrete) relative phase θ are two compatible observables for two coherent states with random phases. Denote the projective measurement on the basis {|k, j θ Ã 1,Ã2 } to be a global photon-number and encoded relative-phase measurement M (k, θ), which will be frequently used in the following security proof. It is easy to check that, the conditional states {|λ 2µ 1,2 (k), j θ } k,j θ with different photon numbers k are orthogonal with each other. We now consider the following two encoding procedures, 1. Alice first prepares an entangled state |ψ 1,2 Ã 1Ã2,A1A2 . She them performs the measurement M (k, θ) defined in Eq. (13) onÃ 1 andÃ 2 to determine the global photon number k and the encoded relative phase θ = j θ 2π D on the emitted optical modes A 1 and A 2 ; In Ref. [1], it has been shown that the resultant states in the second procedure are also {|λ 2µ 1,2 (k), j θ } k,j θ . As a result, these two encoding procedures are equivalent.
In the extreme case when D → ∞, the state |λ 2µ 1,2 (k), j θ A1A2 becomes which is independent of the intensity µ. Especially, the state with global photon number k = 1 and the relative phase φ j θ becomes which forms a qubit subspace widely used in QKD.

Supplementary Note 2. SECURITY OF MODE-PAIRING SCHEME
In this section, we prove the security of the MP scheme via proving the security of its equivalent entanglement version. The major tool we use in the security proof is the QKD equivalence argument.
For a generic MDI-QKD setting, Alice and Bob can view Charlie's site as a joint measurement, M c , on emitted optical pulses. Here, measurement M c contains all Charlie's operations, including measurement on emitted optical pulses, data processing, and the announcement strategy. The measurement-device-independent property makes measurement M c a black box to Alice and Bob. Based on the measurement result, C, Alice and Bob perform a key-generation operation, M ab , to their ancillary states to get the final private states, where the key-generation operation M ab includes state measurement, key mapping, parameter estimation, and data post-processing. The whole procedure is depicted in Supplementary Figure 3.
Supplementary Figure 3. Generic MDI-QKD. The red part owned by Charlie is uncharacterized and untrusted. The blue part is well characterized in Alice and Bob's hands. In general, Charlie's joint measurement outcome, C, controls Alice and Bob's key-generation operation, M ab . This (classical) control operation is fixed by the protocol. That is, given a measurement result, C, Alice and Bob know exactly how to operate on their ancillary states to extract the final key. We can treat the whole circuit in the gray dashed box as a gigantic operation on the initial state, ρ ABA B , to output a private key state, ρ P . Lemma 1 (Equivalent MDI-QKD). Two MDI-QKD schemes, in the form of Supplementary Figure 3, generate the same private state given the same attack and hence are equivalent in security, if the following items are the same, 1. Alice and Bob's initial states, including emitted quantum states of system AB and ancillary states of system A B ; 2. the (classical) control operation for key generation, C-M ab .
Here, item 2 implies the dependence of Alice and Bob's key-generation operation M ab shown in Supplementary Figure 3 are the same in the two schemes if Charlie's announcements C are the same.
Proof. Since Alice and Bob's initial states in both schemes are the same, the spaces of possible operations M c Charlie can perform on system AB are the same. Then, we only need to compare the resultant private key states, ρ P , when Charlie performs the same operations M c on the two schemes.
In Supplementary Figure 3, we can treat the whole circuit as one gigantic operation, as shown in the gray dashed box. If Charlie's operations M c are the same in the two schemes, the final private states are the same, because they both come from the same operation on the same state. In MDI-QKD, an eavesdropper's attack is reflected in M c . Given any attack, the two schemes would render the same private key states. Therefore, the security of the two schemes are equivalent in security.
Corollary 1 (Equivalent MDI-QKD under post-selection). Two MDI-QKD schemes, in the form of Supplementary Figure 3, are equivalent in security, if the following items are the same, 1. Alice and Bob's initial states, including emitted quantum states of system AB and ancillary states of system A B , after a post-selection procedure that is independent of Charlie's announcement C; 2. the (classical) control operation for key generation C-M ab .
The Corollary 1 is a direct result of Lemma 1. Based on Corollary 1, we can introduce extra encoding redundancy in MDI-QKD. If the encoding state of the new MDI-QKD scheme is the same as the original one with proper postselection independent of Charlie's announcement C, then the security of the new scheme is equivalent to the original one.
The main procedure to prove the security of the mode-pairing scheme is to reduce the entanglement-based MP scheme to the traditional single-photon MDI-QKD scheme through a few source-replacement steps, as sketched out in Supplementary Figure 4. For the security proof, we work our way backward from the final stage to the first one. For the completeness of the analysis, we will also review the well-established security proof of the single-photon two-mode MDI-QKD and the coherent-state two-mode MDI-QKD schemes with the source-replacement language.
Supplementary Figure 4. Sketch of the security proof of the MP scheme. The main idea is to introduce source replacement and then reduce the security of the MP scheme to that of single-photon MDI-QKD, where the X-basis error rate can be used to fairly estimate the Z-basis phase-error rate.
In Supplementary Note 2 A, we review an single-photon two-mode MDI-QKD scheme whose security can be easily verified by the Lo-Chau security proof based on entanglement distillation [3].
In Supplementary Note 2 B, we review coherent-state two-mode MDI-QKD. Based on the methods in Supplementary Note 1, we replace the random phase systems with ancillary qudits. By introducing overall photon-number measurement, we can reduce the encoding state to the single-photon MDI-QKD case reviewed in Supplementary Note 2 A.
In Supplementary Note 2 C, we introduce a mode-pairing scheme with a fixed pairing setting, where the prepared states in different rounds are identical and independently distributed (i.i.d.). We then reduce the MP scheme to the two-mode MDI-QKD scheme. To do so, we perform global control gates on the ancillary qubits and measure them to assign the bases, denoted by τ , and perform post-selection. We show that the encoding states of the MP scheme with proper post-selection will be the same as those of the two-mode MDI-QKD scheme.
In Supplementary Note 2 D, we consider the MP scheme in which the pairing setting is not predetermined, but rather is determined by Charlie's announcements. We will show that when choosing a pairing setting based on Charlie's announcements, the free-pairing MP scheme is equivalent to the fixed-pairing MP scheme with the same pairing setting. The arbitrariness of the pairing setting gives us the freedom to choose pairing strategies, which can even be determined by Charlie.
In Supplementary Note 2 E, we discuss the security of the MP schemes without actual photon-number measurement, which is the case for the prepare-and-measure one. We will see that, following similar proof methods in Supplementary Note 2 C and Supplementary Note 2 D, we introduce decoy-state estimation in the MP schemes and prove the security.
Finally, in Supplementary Note 2 F, we reduce the entanglement-based scheme to the prepare-and-measure one in the main text via the Shor-Preskill argument [4].

A. Single-photon two-mode MDI-QKD
We start with the case where Alice and Bob both hold single-photon sources. The diagram of a two-mode MDI-QKD scheme is shown in Supplementary Figure 5 [5,6]. Alice holds an ancillary qubit system A that interacts with two optical modes, A 1 and A 2 . The single-photon subspace of the two modes forms a qubit. Bob's encoding and post-selection procedures are the same as those of Alice unless otherwise stated. The encoding process is shown in Supplementary In the two-mode MDI-QKD scheme, Alice and Bob each emit encoded signals to a measurement device controlled by Charlie in the middle, who is supposed to correlate their emitted signals. Alice (Bob) uses a single photon on two orthogonal modes A 1 (B 1 ) and A 2 (B 2 ) as a qubit. The Z basis of the qubit is naturally defined as For simplification, we omit the tensor notation ⊗ between different modes unless any ambiguity occurs. The {X(θ)} θbasis is defined as where θ ∈ [0, π). When θ = 0 and π/2, these become the eigenstates of the X and Y bases, respectively. A state on the X-Y plane can then be denoted by where θ denotes the basis and κ denotes the sign of the state. The basis defined by {|ψ θ x (κ) } κ=0,1 is called the X(θ)-basis.
In Supplementary Figure 6, the generated encoding state is where the superscript Sin indicates that the state is of a single photon. If we regard the single-photon as a qubit, then |Φ Sin 0 is the Bell state. For the qubit system A , we can similarly define the X(θ)-basis using Eq. (18). To realise an X(θ)-basis measurement on A , one first performs a Z-axis rotation R Z (θ) on A before performing X-basis measurement, Therefore, as shown in Supplementary Figure 7(c), an X(θ)-basis measurement on A can be equivalently realised by first modulating the phase of A 1 by θ and then measuring A on the X-basis. We also remark that a Z-basis measurement on |Φ Sin θ is equivalent to one on |Φ Sin 0 . Hereafter, we establish the Z basis as for key generation and the X(θ) basis only for parameter estimation. The single-photon two-mode MDI-QKD with a fixed θ runs as shown in Box 1.   3. Announcement: Charlie announces the L 1 , R 1 , L 2 and R 2 detection results. If one of L 1 and R 1 clicks and one of L 2 and R 2 clicks, then Alice and Bob keep their signals. If it is (L 1 , R 2 )-click or (L 2 , R 1 )-click, then Bob applies Z gate on his qubit B .
Alice and Bob perform the above steps over many rounds and end up with a joint 2n-qubit state ρ A B ∈ (H A ⊗ H B ) ⊗n .
4. Parameter estimation: Alice decides at random whether to perform measurements in the Z or X(θ) basis and announces her basis choice to Bob. They then measure A , B in the same basis. They announce the X(θ)-basis measurement results and estimate the (phase) error rate. The Z-basis measurement results on ρ A B are denoted by the raw-data string κ a and κ b .
5. Classical post-processing: Alice and Bob reconcile the key string to κ a via an classical channel by consuming l ec key bits. They then perform privacy amplification using universal-2 hashing matrices. The sizes of the hashing matrices are determined by the estimated phase-error rate of κ a from the X(θ)-basis error rate.
The security of this single-photon MDI-QKD can be reduced to that of the BBM92 scheme [7]. Following the security proof based on complementarity [3,4,8], we must estimate the phase-error rate, i.e., the information disturbance in the complementary basis of the Z basis for key generation. Since the single-photon source is basis-independent, one can fairly estimate the phase-error rate of the Z basis using the X(θ) basis.
In the classical post-processing, the information reconciliation is conducted by an encrypted classical channel with the consummation of a preshared l ec -bit key. This is for the convenience of the description of the security analysis. In practice, one can apply different ways of one-way information reconciliation without encryption. The key rate of the single-photon MDI-QKD under the one-way classical communication will be the same.

B. Coherent-state two-mode MDI-QKD
In practice, the users can replace single-photon sources with weak coherent-state sources. The security of coherentstate MDI-QKD schemes have already been well studied in previous MDI-QKD works [5,6], where a photon-numberchannel model is assumed. That is, the untrusted Charlie first measures the global photon number k a and k b on Alice's and Bob's emitted optical modes, respectively. Based on the measurement outcomes, Charlie then decides the follow-up measurement and announcement strategy.
Here, we prove the security of coherent-state two-mode MDI-QKD from a new perspective where the random phases are purified and stored locally, as mentioned in Supplementary Note 1 B. In this way, Alice and Bob can decide and perform the photon-number measurement on the optical modes after emitting the signals to Charlie.
In the original coherent-state two-mode MDI-QKD scheme, Alice first generates two random phases, φ a 1 and φ a 2 , which are independently and uniformly chosen from [0, 2π), and then performs the encoding process shown in Supplementary Figure 8. The Z-basis encoding state is We use the notation θ a := φ a 1 − φ a 2 . The state can also be written as If we randomise the phase φ a 2 uniformly in [0, 2π) and keep θ a fixed, then the single-photon part of the resultant state is |Φ Sin θ a in Eq. (20), In what follows, the coherent state with complex amplitude √ µe iφ will always be written in this form | √ µe iφ to avoid the ambiguity to the Fock states |0 , |1 , ..., |k . Recall that the Z-basis measurement result on the state |Φ Sin θ a is independent of the relative phase θ a . For any fixed θ a , an X(θ)-basis measurement on |Φ Z µ (θ a , φ a 2 ) is equivalent to an X(θ + θ a )-basis measurement on |Φ Z µ (0, φ a 2 ) . Hereafter, we do not discriminate between encoded states with different θ a for the Z basis. Now, we further perform the source replacement for the encoded random phases φ a 1 and φ a 2 , following the methods used in Supplementary Note 1. To do this, we first assume the random phases φ a 1 and φ a 2 are discretely and uniformly randomised from the set { 2π D j} j∈ [D] . Here D is the number of discrete phases. Note that picking up a D ≥ 10 would make the discrete phase randomization very close to the continuous one [1]. Then, we introduce two ancillary qudit systemsÃ 1 andÃ 2 with d = D to store the random phase information, as shown in Supplementary Figure 2 The whole Z-basis encoding state with the purified random phase system is where φ j1 := 2π D j 1 and φ j2 := 2π D j 2 are the two random phases with indices j 1 and j 2 , respectively. The X(θ)-basis encoding state is Similar to the Z-basis case, we introduce purified systemsÃ 1 andÃ 2 to register the random phase information, To reduce the Z-basis and X(θ)-basis encoding state |Φ Z µ and |Φ to the single-photon encoding state |Φ Sin θ in Eq. (20), we have the following lemma.
Lemma 2 (Encoding-state reduction from coherent-state to single-photon two-mode MDI-QKD). In coherent-state two-mode MDI-QKD, Alice generates the state |Φ Z µ defined in Eq.  is k = 1 and θ = 2π D j θ , then the conditional state on A , A 1 and A 2 will be reduced to |Φ Sin θ defined in Eq. (20).
Proof. In Section Supplementary Note 1 B, we introduce a global basis transformation on the ancillary systemsÃ 1 andÃ 2 . Assuming all the phases are discretely chosen from the set { 2π D j} j∈ [D] , we can express a purified encoded state Eq. (24) and transform the basis on it, Here, in the third equality, we introduce a partial Fourier transform defined in Eq. (9). In the fifth equality, we simplify the expression by a phase-gateÛ A1 (φ) := e iφa † 1 a1 and a controlled-swap gateĈ-SW AP defined on a qubit A and two optical modes,Ĉ In the sixth equality, we use the pseudo-Fock state definition in Eq. (6). The probability is a mixture of the Poisson distribution probability P µ (k) := e −µ µ k k! . In the seventh equality, the state |λ µ Z (k), j θ A,A1A2 is is a normalized state with pseudo-Fock number k and relative phase θ = 2π D j θ . When D → ∞, the probability P µ k becomes the Poisson distribution. The conditional encoding state |λ µ Z (k), j θ A ,A1A2 becomes which is irrelavant to the intensity µ. Especially, when k = 1, the conditinal state becomes Here, |Φ Sin θ is defined in Eq. (20). When D is finite, the equality of Eq. (32) becomes approximation due to the discrete phase randomisation effect. It has been shown in the literature [1,2] that when D ≥ 12, the discrete phase randomization is very close to the continuous one.
If we perform the same basis transformation onÃ 1 andÃ 2 as the one for the Z-basis state in Eq. (27), the X(θ)-basis encoding state will become .
(33) Here, in the second equality, we use the partial Fourier transform in Eq. (9). In the fourth equality, we simplify the expression with a Hadamard gateĤ A on the qubit A and the controlled phase gateĈ-U (φ) A ,A1 , The state |λ 2µ 1,2 (k), j θ A ,A1A2 is defined in Eq. (12). In the fifth equality, we define If Alice performs the measurement M (k, θ) defined in Eq. (13) on the ancillary systemsÃ 1 andÃ 2 and obtains k and θ = 2π D j θ , then the conditional emitted state is |λ 2µ . When D → ∞, the probability P 2µ k to get the photon-number result k becomes the Poisson distribution. As is shown in Eq. (14), the state |λ 2µ 1,2 (k), j θ A ,A1A2 (and hence the state |λ 2µ ) becomes independent of the intensity µ. Especially, when k = 1, the conditional where |Φ Sin θ is defined in Eq. (20). Again, when D ≥ 12, the approximation caused by discrete (instead of continuous) phase randomization can be ignored.
As is shown in Eqs. (27) and (33), Alice can obtain the information of the overall photon number k of A 1 and A 2 indirectly based on the collective measurement on the ancillary systemsÃ 1 andÃ 2 . When the measurement result is k = 1, both of the Z-basis and X(θ)-basis encoding state will be reduced to the single-photon encoding state |Φ Sin θ defined in Eq. (20). In this way, the security of the coherent-state MDI-QKD will be reduced to the one of single-photon MDI-QKD.
In the coherent-state two-mode MDI-QKD scheme, Alice and Bob use Z-basis data to generate a secure key and X(θ)-basis data to estimate information leakage, reflected in the X(θ)-basis single-photon error rate e X(θ) , as randomly chosen from [0, 2π). During the basis-sifting process, Alice and Bob sift the data with θ a − θ b = 0 or π to estimate the privacy of raw keys generated in the Z-basis. Here, we mix all X(θ) data with different θ to estimate the average phase-error rateē X 11 , where P (θ) is the conditional probability of choosing the alignment angle θ in all of the sifted X-basis data with θ a = θ b and e X(θ) (1,1) is the phase-error rate when the alignment angle is θ a = θ b = θ. This averaged phase-error rate can still faithfully characterise the privacy of Z-basis key generation due to the concavity of the binary entropy function.
From Lemma 2 we can see that, in the coherent-state two-mode MDI-QKD scheme, if Alice and Bob post-select the signals with the overall photon number k a = k b = 1, then the remaining signals can be used to extract key information similar to the single-photon MDI-QKD scheme in Supplementary Note 2 A. In practice, Alice and Bob do not need to keep track of the photon number data and perform the photon-number post-selection. Instead, they may apply the "tagging" idea [9]: they first keep all the raw-key data generated by different photon numbers k a and k b and treat the photon number as a "tag" on the emitted signal; they then estimate the fraction q (1,1) of the single-photon-pair signals with k a = k b = 1 among all the raw-key data and the X(θ)-basis error rate of the single-photon-pair signals e X(θ) (1,1) . Based on the estimation of q (1,1) and e X(θ) (1,1) , they can also extract the same amount of secure keys by designing proper privacy amplification procedures. The key-rate formula is given by [9] where q (1,1) is the estimated detected fraction of single-photon components, H(x) is the binary entropy function, and f is a factor that reflects the efficiency of information reconciliation. Q µµ and E µµ are the overall detected fraction and bit-error rate when Alice and Bob emit coherent states with intensity µ. Furthermore, Alice and Bob do not have to measure the photon-number k a and k b in each round. Thanks to the photon-number Poisson statistics and the independence of the photon-number state to the intensity setting in Lemma 2, Alice and Bob can vary the intensity µ to estimate the single-photon component in the final detected rounds using decoy-state methods [10].
To summarize, we list the coherent-state two-mode MDI-QKD in Box 2. Here, we asuume that Alice and Bob perform the photon-number measurement, but perform the data post-processing based on the tagging key rate formula in Eq. (38).
Box 2: Coherent-state two-mode MDI-QKD 1. State preparation: Alice decides at random whether to prepare the Z-or X(θ)-basis states. For the Z-basis, Alice prepares an entangled state |Φ Z µ defined in Eq. (24) using the device in Supplementary Figure 8(a), which contains a qubit system A , two ancillary qudit systemsÃ 1 andÃ 2 , and two optical modes A 1 and A 2 . For the X(θ)-basis, she prepares |Φ 3. Announcement: Charlie announces the L 1 , R 1 , L 2 and R 2 detection results. If one of L 1 and R 1 clicks and one of L 2 and R 2 clicks, Alice and Bob keep the signals. Alice performs M (k, θ) measurement defined in Eq. (13) on quditsÃ 1 andÃ 2 to obtain the photon number k a and the relative phase θ a . Bob operates similarly to obatin k b and θ b . If there is an (L 1 , R 2 )-click or (L 2 , R 1 )-click, then Bob applies the Z gate to his qubit B . They announce the measured photon number k a and k b .
4. Basis sifting: Alice and Bob announce that the chosen basis is either Z or X(θ). If the chosen basis is X(θ), they further announce the relative phases θ a and θ b . If they both choose the Z-basis or the X(θ)-basis with θ a − θ b = 0/π, they keep their data.
Alice and Bob perform the above steps over many rounds and end up with a joint 2n-qubit state 5. Key mapping: Alice and Bob measure the qubit systems A and B in the Z or X bases when the predetermined bases are Z or X(θ), respectively. They record the Z-basis measurement results as the raw-data strings κ a and κ b .
6. Parameter estimation: Alice and Bob announce the X(θ)-basis measurement results. Based on the announced information, they then estimate the X(θ)-basis error rate e X(θ) (1,1) for all the signals with k a = k b = 1 and the fraction of signals with k a = k b = 1 in the remained signals q (1,1) . 7. Classical post-processing: Alice and Bob reconcile the key string to κ a and perform privacy amplification using universal-2 hashing matrices. The sizes of hashing matrices are determined by the estimated single-photon-pair fraction q (1,1) and X(θ)-basis error rate e X(θ) (1,1) according to Eq. (38).

C. Fixed-pairing MP scheme
In this subsection, starting from the coherent-state MDI-QKD scheme, we introduce extra encoding redundancies to construct the mode-pairing (MP) scheme. The major differences of the MP scheme and the coherent-state two-mode MDI-QKD are 1. All the optical modes are decoupled during the encoding process; the correlation among two different rounds i and j are built after the generation of encoding states; 2. Instead of being determined at the beginning, the basis choice for each pair of location is determined by a pairwise measurement on the ancillary systems afterwards.
Unlike the coherent-state MDI-QKD scheme where Alice emits two correlated optical modes in each round, in the MP scheme, Alice first emit optical modes in an i.i.d. manner, then group each two of the sending locations together as a "pair". She then perform collective quantum operations on each pair to extract the correlation information. The concept of "pairing" is formalized below. For the convenience of later discussion, we also define Charlie's announcement. Once the N optical modes are paired, we can denote the location of the k-th pair as (F k , R k ), where F k and R k are the front and rear pulse locations of the k-th pair, respectively. The pairing setting χ can also be viewed as a vector formed by (F k , R k ). Without loss of generality, we focus on two specific paired locations 1 and 2 in the following discussions.
In the security proof, we first consider a simple MP scheme, where the pairing setting χ is not related to the untrusted Charlie's announcement. We call this MP scheme the fixed-pairing MP scheme. In the MP scheme, Alice sends out a coherent state with independent intensity and phase modulation in each round, where z 1 and z 1 are two random bit values indicating the encoded intensity and 0/π-phase, respectively;z 1 is a random dit indicating the discrete random phase. Here, we take the encoding state of the first round, with subscript 1, as the example.
To introduce the entanglement version of the scheme, we perform the source replacement to introduce two ancillary qubits A 1 and A 2 and an ancillary quditÃ 1 . In this case, Alice will generate the same composite state |Ψ Com for every round, which is composed of an ancillary quditÃ 1 , two ancillary qubits A 1 and A 1 , and an optical mode A 1 . In the second equality, we use the following definition of the state |Ψ Interestingly, Alice can post-select the encoding state of coherent-state MDI-QKD by performing some collective operations on two location pairs, as is stated in the following lemma.
Lemma 3 (Encoding-state reduction from the fixed-pairing MP scheme to coherent-state MDI-QKD). Alice generates two composite states, |Ψ Com Ã 1,A 1 ,A 1 ,A1 and |Ψ Com Ã 2,A 2 ,A 2 ,A2 , as defined in Eq. (40), on two locations 1 and 2, respectively. Locally, Alice applies a CNOT gate from A 1 to A 2 , measures A 2 on the Z basis, and obtains a result τ a .
If τ a = 1, Alice assigns the Z basis. She then measures A 1 and A 2 on the Z-basis to obtain results z 1 and z 2 , respectively. Then, the conditional state in the systemsÃ 1 ,Ã 2 , A 1 , A 1 and A 2 can be reduced to the Z-basis encoding state |Φ Z µ of Eq. (24) used in the coherent-state MDI-QKD scheme in Supplementary Note 2 A with possible π-phase modulations on the optical modes A 1 and A 2 when z 1 = 1 and z 2 = 1, respectively.
If τ a = 0, Alice assigns the X(θ) basis. She first measures A 1 on the Z basis to obtain the result λ a . If λ a = 0, the state will become |Φ X(θ) 0 , which is used for the decoy state estimation. If λ a = 1, Alice applies a CNOT gate from A 2 to A 1 . After that, Alice measures A 2 on the Z basis to obtain the result ζ a . Then the conditional state in the systems A 1 ,Ã 2 , A 1 , A 1 and A 2 can be reduced to the X(θ)-basis encoding state |Φ of Eq. (26) used in the coherent-state MDI-QKD scheme in Supplementary Note 2 A with a possible simultaneous π-phase modulation on the optical modes A 1 and A 2 when ζ a = 1.
Proof. We first summarize the introduced reduction procedure in Supplementary Figure 9, which is independent of Charlie's operation.
To perform the basis-assignment measurement, Alice first performs a CNOT gate on qubits A 1 and A 2 and then measure A 2 . After the CNOT gate, the joint state on where |Ψ . Now, Alice performs Z-basis measurement on the system A 2 to determine the encoding basis.
When the outcome is τ a = 1, the post-selected state is where |Φ Z µ Ã 1Ã2 ,A 1 ,A1A2 is defined in Eq. (24). Now, suppose Alice measures the systems A 1 and A 2 on Z-basis and obtains the results z 1 and z 2 . The post-selected state on the systems A 1 , A 1 , A 2 will become the Z-basis encoding state |Φ Z µ of the coherent-state MDI-QKD scheme with a possible π-phase modulation on the optical modes A 1 and A 2 , depending on the values z 1 and z 2 . This reduction process is illustrated in Supplementary Figure 10.
We remark that, for the single-photon component, a π-phase modulation on the optical modesÃ 1 andÃ 2 can be regarded as a Z-axis rotation on the ancillary qubit A shown in Supplementary Figure 7. This rotation will not affect the Z-basis measurement result. Therefore, the π-phase modulation on A 1 and A 2 will not affect the security of the Z-basis key generation.
On the other hand, when τ a = 0, the post-selected state is In this case, Alice further measures A 1 on the Z basis and keeps her signals if the result is 1. The post-selected state is then |Ψ is defined in Eq. (41). We remark that, if the measurement result on A 1 is 0, then the state will not be used for key generation; instead, it can be used for the parameter estimation. After we measure the ancillary qubits A 1 and A 2 on Z-basis and obtain the results z 1 and z 2 , we will project the remaining encoding state to |Φ Z µ with extra phase modulations z 1 π and z 2 π on the optical modes A1 and A2, respectively. The extra π-phase modulation will not affect the security and the performance of the Z-basis coherent-state MDI-QKD scheme.
To reduce the state |Ψ of coherent-state MDI-QKD scheme defined in Eq. (26), Alice applies a CNOT operation from the system A 2 to A 1 , measures A 2 on the Z-basis, and records the result ζ a . As is shown in Supplementary Figure 11, we can equivalently move the Z-basis measurement on A 2 forward to the beginning. In this way, we can reduce the encoding state to |Φ with a simultaneous π-phase modulation on the optical modes A 1 and A 2 . For the X(θ)-basis coherent-state MDI-QKD scheme, such π-phase modulation will not cause any effect.
Based on Lemma 3, we introduced the fixed-pairing MP scheme in Box 3, which is also illustrated in Supplementary  2. Measurement: Alice and Bob send modes A i and B i to Charlie, who is supposed to perform the single-photon interference measurement. Charlie announces the clicks of the detectors L and/or R.
Alice and Bob perform the above steps over many rounds. Afterwards, they perform the following data post-processing.
3. Mode Pairing: Based on a pre-set pairing setting χ ∈ X , Alice and Bob pair their locations (i.e., group each two locations together).

Basis
Sifting: For each pair on locations i and j, Alice performs the basis-assignment measurement on A i and A j to determine the basis, as shown in Supplementary Figure 9. If the result τ a = 0, Alice further measures A i on the Z-basis and records the result λ a . Alice assigns the basis of the pair as Z if τ a = 1, X if τ a = 0 and λ a = 1 and '0' if τ a = λ a = 0. Bob assigns the basis in the same way. Alice and Bob announce their bases. If the announced bases are the same, X, X or Z, Z, they keep their signals. Supplementary Figure 11. Reduction of encoding in Supplementary Figure 9(b) to the X(θ)-basis encoding state |Φ in Eq. (26) and Supplementary Figure 8(b). From (a) to (b), we advance the Z-basis measurement on A 2 . This entails introducing an extra random number ζ a in the phase modulations of A1 and A2, as shown in (c). We remark that, a simultaneous phase modulation will not affect the security and performance of the X(θ)-basis coherent-state MDI-QKD.
A i . Alice then performs global measurement M (k, θ) defined in Eq. (13) on quditsÃ i andÃ j to obtain the photon number k a and the relative phase θ a . Bob operates similarly. For all X pairs, Alice and Bob further announce θ a and θ b . If θ a = θ b , they keep the X-pair data; if θ a − θ b = π, they keep the X-pair data with Bob applying the Z gate on his left qubit. Moreover, if Charlie's announcement on locations i and j is (L, R) or (R, L), Bob applies Z gate on the qubit system B i for the X-pairs. Alice and Bob then measure the ancillary qubits A and B of all the X-pairs and the ancillary qubits A and B of all the Z-pairs on the Xand Z-bases, respectively, to obtain the raw key bits κ a and κ b .
6. Parameter estimation: Alice and Bob estimate the fraction of clicked single-photon signals q (1,1) and the corresponding phase-error rate e X(θ) (1,1) in the Z-pairs, with Alice and Bob both emitting a single photon at locations i and j.
2 hashing matrices. The sizes of hashing matrices are determined by the estimated single-photon yield q (1,1) and the X(θ)-basis error rate e Here we take the pair on location 1 and 2 for example. Alice and Bob both generate a composite state |Ψ Com on an optical mode, two ancillary qubits and a ancillary qudit in each round and send the optical modes to Charlie. After Charlie's detection announcement, they perform control operations on the ancillary qubits at the predetermined paired locations and perform measurements on them. They then perform Z-basis measurements on all the ancillary qubits . The usage of these results is listed in Supplementary Figure 18(d).
We introduce encoding redundancies in the coherent-state MDI-QKD scheme, so that the proposed MP scheme owns i.i.d. state preparation process in each round. Due to this i.i.d. encoding property, we can see that the MP scheme can be reduced to the coherent-state scheme based on Lemma 3 for any given pairing setting χ. We now clarify this lemma.
2. (Independence of the photon-number states to the intensity) The resultant state after the joint measurement M (k, θ) is independent of the intensity values µ a and µ b .
3. (Basis-independence of the single-photon pairs) For the location pairs with the overall photon-number measurement result k a = k b = 1, the X(θ)-basis error rate can be used as a fair estimation of the Z-basis phase-error rate.
As a result, with any fixed pairing χ, the χ-fixed-pairing scheme is able to generate secure key strings with the tagging key-rate formula, Eq. (38).
Proof. The process of a χ-fixed-pairing scheme can be sketched in Supplementary Figure 13(a).
In the fixed-pairing scheme, Alice and Bob start with 2n rounds of the state |Ψ Com defined in Eq. (40). Based on pairing strategy χ, they first perform the mode-pairing operation described in Lemma 3 to (1) decide the X/Z-basis of the pairs of rounds; (2) reduce the encoding state to the encoding state of coherent-state-based MDI-QKD. Here, we denote the randomly determined X/Z-basis information of Alice's and Bob's on the location pair (i, j) are stored as two random numbers τ a i,j and τ b i,j , respectively. From Lemma 3, we can see that under any pairing setting χ, with the given basis-assignment and post-selection condition, Alice and Bob can generate the encoding states |Φ Z µ for τ a i,j = 1 or |Φ for τ a i,j = 0 in the coherent-state MDI-QKD scheme. The value of τ a i,j or τ b i,j follows a uniform distribution of 0 and 1.
After that, they perform a pairwise measurement M (k, θ) defined in Eq. (13) on the post-selected state. From Lemma 2, we see that the results (k a , k b ) of M (k, θ) defined in Eq. (13) obey the Poisson distribution; after the pairwise measurement M (k, θ), the post-selected photon-number state is independent of the intensity setting µ a and µ b ; the post-selected encoding states with k a = k b = 1 will become to the one in the single-photon MDI-QKD scheme, |Φ Sin θ in Eq. (20). If Alice and Bob post-select the corresponding encoding states, the security of this scheme will be equivalent to the single-photon MDI-QKD scheme, where the encoding state is basis-independent and the security proof can be easily done based on the complementarity. If we set the photon numbers k a and k b to be the tag on the MP scheme, the key rate of the MP scheme also follows the traditional tagging key-rate formula in Eq. (38).
In Supplementary Figure 13(a), after Alice and Bob post-select the rounds with encoding state |Φ Sin θ , they will emit the optical modes {A i , B i } to Charlie, who will perform some unknown measurement M c and announce the detection result C.
In the following security proof, we will consider the security of the post-selected ancillary state conditional on a specific Charlie's announcement C. In the fixed-pairing scheme in Supplementary Figure 13(a), we denote the normalized post-selected ancillary state at Alice and Bob's hand conditional on Charlie's specific measurement M c and announcement C as σ (1) A B (M c , C, χ). Here, the superscript (1) denotes that the state is generated from the single-photon source state with k a = k b = 1. Alice and Bob then perform parameter estimation and distil private key state ρ P (M c , C, χ) from σ (1) A B (M c , C, χ). The X/Z-measurement bases are determined by the random numbers τ a i,j and τ b i,j generated during the mode-pairing operations. Based on Lemma 4, we will have the following proposition. Proposition 1 (Strong basis-independence of the fixed-pairing scheme). In a χ-fixed-pairing scheme illustrated in Supplementary Figure 13(a), for any Charlie's untrusted quantum measurement M c and its result C, Alice and Bob perform mode-pairing operation and photon number measurement based on the pairing setting χ, then perform loss sifting based on C, and keep a normalized conditional state σ (1) A B (M c , C, χ) with k a = k b = 1. Then, for any location pair (i, j), the X/Z-basis information, τ a i,j and τ b i,j of the state σ A B (M c , C, χ) generated by the mode-pairing operation on different location pairs follows an i.i.d. uniform distribution, which is independent of M c and C.
Proof. In Lemma 4 we prove that, when k a = k b = 1, the post-selected encoding state is single-photon state |Φ Sin θ in Eq. (20). The rotation angle θ is determined by the pairwise measurement M (k, θ).
Without loss of generality, we focus on the basis choice τ a i,j of Alice on a location pair (i, j). We remark that, the single-photon encoding states |Φ Sin θ are the same for both Z-and X(θ)-bases, corresponding to the case of τ a i,j = 1 and τ a i,j = 0, respectively. Moreover, the subsystem state of |Φ Sin θ on the emitted optical modes A i and A j is independent of the alignment angle θ. As a result, Charlie's measurement and post-selection based on the optical mode systems cannot bias the basis choices τ a i,j and τ b i,j . As a last step of the security proof of the fixed-pairing scheme, we notice that Charlie's measurement M c commutes with the mode-pairing operation and the pairwise measurement M (k, θ) since they act on different quantum systems. Therefore, we can move Charlie's measurement before the operations acted on the ancillary systems, as shown in Supplementary Figure 13 Proof. The proof can be easily seen from the equivalence of the fixed-pairing scheme in Supplementary Figure 13 The freedom of choosing the pairing setting, χ, in the fixed-pairing MP scheme inspires us to consider a more flexible variant, where χ is determined based on Charlie's announcements C. We call this variant the free-pairing MP scheme, in Definition 5. Note that the pairing setting, χ ∈ X in Definition 1, is chosen for all the N emitted signals, even for the locations without successful detection. This is due to the usage of Lemma 4 in the latter discussion. We remark that, the pairing setting χ in Definition 1 and the pairing strategy T in Definition 4 are defined for all the locations, even for the ones with unsuccessful detections. In a pairing strategy T , we need to pair all the locations based on Charlie's announcement C and do not perform any post-selection. The pairing definition in this way is helpful to build up a connection between the fixed-and free-pairing schemes, so that the loss sifting in the free-pairing schemes will be handled following the same way as the fixed-pairing schemes. For example, suppose there are 4 rounds in the mode-pairing scheme and Charlie announces successful detections on locations 1 and 4, then based on a simple pairing strategy, Alice and Bob pair the locations as follows: (1, 4), (2, 3). The "lost" pair (2, 3) will be used for the parameter estimation.
We also note that, the χ-fixed-pairing scheme can be regarded as a special case of the T -free-pairing scheme, where the pairing strategy is a constant function, T ( C) ≡ χ, ∀ C ∈ C. Following the fixed-pairing MP scheme in Box 3, we present the procedures of the free-pairing MP scheme with a pairing strategy T in Box 4. Alice and Bob perform the above steps over many rounds. After that, they perform the following data post-processing steps. In the free-pairing scheme, Charlie announces C and then Alice and Bob determine χ based on C. In a way, Charlie can manipulate the choice of paring settings.
Before we examine the free-pairing scheme, we first briefly review the process of fixed-pairing scheme and revisit what we proved in Lemma 4 and Proposition 2. A simple diagram of χ-fixed-pairing scheme is shown in Supplementary  Figure 14 In what follows, we prove the security of the free-pairing scheme by its conditional equivalence to the fixed-pairing scheme and Proposition 2. We now clarify the conditional equivalence argument.
Proposition 3 (Conditional equivalence of two MP schemes). For two different MP schemes with pairing strategies T 1 and T 2 , respectively, if measurement M c and announcement C are the same, then post-selected ancillary states σ A B (M c , C) for these two schemes will be the same. Moreover, if we have T 1 ( C) = T 2 ( C), that is, pairing settings χ 1 and χ 2 are the same, then the resulting states after key distillation will be the same.
Proof. To begin with, we list the variable dependence in a T -free-pairing scheme in Supplementary Figure 15. We can see how Charlie's measurement affect the pairing setting χ and the private key state ρ P (M c , C, χ).
We notice that all the MP scheme share the same encoding state ρ ABA B , that is |Ψ Com defined in Eq. (40). Then from the variable dependence in Supplementary Figure 15, one can clearly obtain this proposition.
We remark that, this conditional equivalence argument is weaker than the one we define in Lemma 1. In Proposition 3, we only compare the post-selected ancillary state under a specific Charlie's measurement M c and announcement C. However, combined with Proposition 2, this is sufficient for a complete security proof of a T -free-pairing scheme. 3. Given Charlie's measurement M c , the final state generated by a T -free-pairing scheme is equal to the private state ρ P (M c , C, χ) generated by one of the χ-fixed-pairing schemes.
The first statement is a direct result of Lemma 4 and Proposition 2.
To prove the second statement, we notice that the encoding state prepared in both free-pairing and fixed-pairing schemes are the same. Then, Charlie receives exactly the same quantum states in the two schemes. The only difference is that Charlie receives different classical information of the pairing strategies T ∈ T . Recall that the fixed pairing χ is a special pairing strategy in T . The second statement becomes the following question: for any Charlie's measurements M c in a T -free-pairing scheme, whether Charlie can perform the same M c in a fixed-pairing scheme. Since the pairing strategy T is independent of the quantum states sent to Charlie, the answer is yes and hence the second statement holds. Now, we prove the third statement. For a given Charlie's measurement M c , we can list the resultant ancillary states σ( C) at Alice and Bob's hand corresponding to different measurement results C, shown in Supplementary Figure 16. Furthermore, we list all the possible resultant states ρ P after the key-generation operation M ab correspond to different fixed pairing settings χ ∈ X in the fixed-pairing MP schemes, shown in Supplementary Figure 16.
In the T -free-pairing scheme in Definition 5, Alice and Bob choose the pairing setting χ = T ( C) during the key generation process M ab . For a pairing strategy T ∈ T in Definition 4, we have T ( C) ∈ X . In this case, in a T -freepairing scheme, the resultant state after the key-generation operation will be the same as a private key state from one of the fixed-pairing schemes based on Proposition 3.
Combining the three statements, we conclude that: under any possible Charlie's measurement operation M c and announcement C, a T -free-pairing scheme results in a private key state with the key length determined by the tagging key-rate formula Eq. (38).
Having said that Alice and Bob can choose the pairing strategy T freely even based on Charlie's announcement C, the pairing setting χ cannot depend on the measurement results of Alice's and Bob's ancillary states. This is due to the fact that in our security proof, the pairing setting χ is determined before any operation on the ancillary states.

E. Security analysis with decoy-state estimation
In the entanglement-based security analysis for the fixed-pairing and free-pairing schemes in Supplementary Note 2 C and Supplementary Note 2 D, we assume that Alice and Bob are able to perform pairwise measurement M (k, θ) to learn photon number k a and k b on each paired signals. In the prepare-and-measure MP scheme that we shall consider below, Alice and Bob do not actually perform such a photon-number measurement. To solve this problem, we introduce the decoy-state method. In this section, we discuss how the proof methods in Supplementary Note 2 C and Supplementary Note 2 D can be naturally extend to the decoy-state analysis.
We first consider the fixed-pairing scheme in Box 3, as illustrated in Supplementary Figure 13. In the decoy-state version of the scheme, instead of performing the pairwise measurement M (k, θ), Alice and Bob consider the following problem during the parameter estimation. The answer to this problem, q (1,1) and e X (1,1) , is sufficient for us to perform privacy amplification based on the tagging key rate formula in Eq. (38). To solve Problem 1 in the fixed-pairing scheme, we have the following proposition, as a corollary to Lemma 4. In the decoy-state version of entanglement-based fixed-pairing scheme, Alice and Bob introduce extra intensities during the state preparation procedure. They can do it by replacing intensity-encoding ancillary qubits A and B to qudits with high dimensions. The mode-pairing operation can then be accordingly modified, based on the scheme introduced in Methods's subsection "Mode-pairing scheme with decoy state". One can follow a similar encodingstate-reduction procedure in Lemma 3 to reduce the encoding states to the ones of coherent-state-based MDI-QKD schemes. Based on Lemma 4 and Proposition 4, Alice and Bob can then characterize q (1,1) and e X (1,1) by counting the statistics of detections with different overall intensities (µ a , µ b ). The detailed decoy-state estimation procedure is introduced in Supplementary Note 3.
We To introduce the decoy-state estimation in the free-pairing scheme with pairing strategy T , we first suppose that Alice and Bob choose to use the key generation operation M ab ( C, χ) with χ = T ( C) with decoy-state estimation same as the χ-fixed-pairing scheme.
The conditional equivalence arguments in Proposition 3 still holds if we consider all the fixed-pairing and freepairing schemes, after including the decoy-state estimation into the key generation operation, M ab ( C, χ). Therefore, we can follow exactly the same argument to prove the security of the free-pairing scheme with decoy-state estimation as we have done in Theorem 1.

F. Prepare-and-measure MP scheme
As the final step, we reduce the entanglement-based free-pairing MP scheme in Box 4 to the prepare-and-measure one presented in the main text. In the following discussions, we focus on the reduction on Alice's side. The reduction of Bob's side follows the same manner. Also, for the simplicity of discussion, we take a paired location 1 and 2 as an example.
First, we remove all the pairwise joint measurements M (k, θ) defined in Eq. (13) used to read out the global photon number and the relative phase on each pair of optical modes. Instead, we assume Alice and Bob measure the (discrete) phase of each pulse directly. In this way, the relative phase can be obtained by classical post-processing. Then, the global photon number is lost due to the uncertain relationship between phase and photon number measurements. In practice, Alice and Bob can use the decoy-state method to estimate the fraction of the single-photon component. Furthermore, we assume the random phase is measured at the beginning, which is then equivalent to a random phase encoding on the emitted optical pulses. In this way, we remove the two ancillary quditsÃ 1 andÃ 2 in the encoding process.
After removing the phase encoding ancillary systems, we are now going to remove the four ancillary qubits A 1 , A 1 , A 2 and A 2 . To do this, we move all the measurements on the ancillary qubits mentioned in Lemma 3 forward. In Supplementary Figure 18(a), we list the complete basis and key-assignment procedure of the entanglement-based MP scheme. The final measurement results σ a , λ a , ζ a and τ a are used in different ways, as shown in Supplementary Figure 18(d). Note that the Z-basis measurements commute with all CN OT gates. Therefore, moving all measurements before the control gates between locations 1 and 2, one can equivalently obtain the measurement results σ a , λ a , ζ a , and τ a by classical post-processing, as shown in Supplementary Figure 18( Supplementary Figure 18. (a) All of the operations that Alice performs on the ancillary qubits A 1 , A 1 , A 2 and A 2 to assign bases and generate raw key bits when the locations 1 and 2 are paired. τ a is used for the basis assignment, λ a is used for key generation in the Z-basis and post-selection in the X(θ)-basis and σ a is used for key generation in the X(θ)-basis. (b) An equivalent process whereby Alice moves all the measurement before the global control gates between locations 1 and 2. The measurement results z 1 and z 1 on A 1 and A 1 reveal the encoded phase and the intensity on A1, respectively. (c) Alice further measures all ancillaries in the beginning. This is equivalent to preparing the coherent states on A1 and A2 with modulated intensities and phases. (d) The values and usage of the variables σ a , λ a , ζ a and τ a .
In Supplementary Figure 18(b), the measurement results z 1 and z 1 on A 1 and A 1 reveal the encoded intensity and phase on A 1 , respectively. Alice further moves the measurements on the ancillary qubits to the beginning. It is then equivalent to preparing the coherent states | z 1 µe iπz 1 , | z 2 µe iπz 2 on A 1 and A 2 with modulated intensities and phases. Thus, we reduce the entanglement-based scheme to a prepare-and-measure version.
Box 5: Prepare-and-measure MP scheme 1. State preparation: In the i-th round, Alice generates two random bits z i and z i and a random phase φ a i uniformly and discretely chosen from { 2π D j} j∈ [D] . She generates a coherent state | z i µe i(πz i +φ a i ) . Similarly, Bob generates two random bits y i and y i , φ b i , and a coherent state | y i µe i(πy i +φ b i ) .
2. Measurement: Alice and Bob send the coherent states to Charlie, who is supposed to perform a single-photon interference measurement. Charlie announces the clicks of the L and/or R detectors.
Alice and Bob perform the above steps over many rounds. Afterwards, they perform the following data post-processing steps.
3. Mode pairing: Alice and Bob set a strategy to pair the clicked locations, i.e., to group each two detected rounds together based on Charlie's announcement.
4. Basis sifting: For each pair on locations i and j, Alice sets τ a := z i ⊕ z j , λ a := z i . Alice sets the basis of the pair to Z if τ a = 1, X if τ a = 0 and λ a = 1, and '0' if τ a = λ a = 0. Bob assigns the basis in the same way. Alice and Bob announce the bases. If the announced bases are X, X or Z, Z, they maintain the signals.
5. Key mapping: For each Z-pair on locations i and j, Alice records λ a as the key bit. For each X-pair, Alice sets σ a := z i ⊕ z j as the key bit and records θ a i,j := φ a i − φ a j for later usage. For all X-pairs, Alice and Bob further announce θ a and θ b . If θ a = θ b , they keep the X-pair data; if θ a − θ b = π, they keep the X-pair data with Bob flipping the value of σ b ; otherwise, they discard the X-pair data. Moreover, if Charlie's announcement at locations i and j is (L, R) or (R, L), Bob flips the value of σ b .
6. Parameter estimation: Alice and Bob use decoy-state methods to estimate the fraction of clicked signals q (1,1) and the corresponding phase-error rate e X (1,1) in the Z-pairs, where Alice and Bob both emit a single photon at locations i and j. They also estimate the quantum bit-error rate E Z (µ,µ) of the Z-pairs. 7. Key distillation: Alice and Bob reconcile the key string to κ a and perform privacy amplification using universal-2 hashing matrices. The sizes of hashing matrices are determined by the estimated single-photon yield q (1,1) and the X(θ)-basis error rate e X(θ) (1,1) according to Eq. (38).
To reduce the scheme to the MP scheme in the main text, we further simplify the announcement of the random phase in the X basis. Note that the encoding phase in the i-th round is φ a i + πz i , with φ a i ∈ [0, 2π). The phase modulation of z i is redundant in the experiment. We now try to absorb it into φ a i . In the following discussion, without loss of generality, we first assume that θ a and θ b are equal to 0 or π. In this case, Alice and Bob's random phases on locations i and j are either 0 or π. We denote them as whereφ a i ,φ a j ,φ b i andφ b j are four binary variables. During the X-basis key mapping, Alice and Bob's raw key and random phase at locations i and j are σ a := z i ⊕ z j , θ a := π(φ a i ⊕φ a j ), Here, the binary variable δ θ := (φ a i ⊕φ a j ⊕φ b i ⊕φ b j ) indicates whether the announcements of θ a and θ b are the same or different. δ θ describes the detection announcement in i and j: if the announcements are (L, L) and (R, R), then δ d = 0; if the announcements are (L, R) and (R, L), δ d = 1.
To simplify the key-mapping strategy, Alice and Bob absorb the random phase z i , z j ; y i , y j into φ a i , φ a j ; φ a i , φ b j . They revise the raw key announcement as follows: Meanwhile, they set the announced basis angle to beθ a =θ b = 0. In this case, the announced information is less than the original scheme. Hence, the privacy of Alice's raw keyσ a will not worsen. The new raw key bit is related to the original raw key bit asσ a = σ a ⊕ (φ a i ⊕φ a j ), Therefore,σ a =σ b iff σ a = σ b . Up to a random phase difference, the new raw key bits are equivalent to the original ones.
In general, θ a and θ b may not be 0 or π. In this case, we revise the random phase announcement. Let Now, we further split θ a r into two parts, where θ a 0 := θ a r mod π ∈ [0, π) denotes half of θ a r while κ a := (θ a r /π) mod 2. Using a similar method, one can show that κ a = κ b iff σ a = σ b . Therefore, in an equivalent but simplified X(θ)-basis key mapping procedure, Alice (Bob) regards the phase (φ a i + z i )((φ b i + y i )) as a whole. They calculate the basis angle as Eq. (50) and (51). The corresponding revised scheme can now be reduced to the MP scheme in the main text.

Supplementary Note 3. DECOY-STATE ESTIMATION
Here, we apply decoy-state analysis [11] to the mode-pairing scheme, with the typical three-intensity settingsvacuum (zero intensity), weak (intensity ν) and signal (intensity µ) states. The discussion below can naturally be extended to the decoy-state method with an arbitrary number of intensities. In the mode-pairing scheme, Alice and Bob each independently generate coherent states with intensities µ a i and µ b i , respectively, for the i-th round. Suppose the state intensities are randomly chosen from the set {0, ν, µ} with probabilities s 0 , s ν and s µ , respectively, where, s 0 + s ν + s µ = 1.
We consider the pairing setting χ in Definition 1, which defined on all the locations, including the locations with unsuccessful clicks. In the practical mode-pairing scheme, Alice and Bob decide the pairing setting based on Charlie's announcement C, which is a 2N -bit string. On each location, Charlie announces two-bit information (L i , R i ), indicating the detection results of the two detectors L and R. The pairing strategy we mentioned in the main text is an algorithm to choose a specific pairing setting χ based on Charlie's announcement C. We simply pair all the unpaired locations (including the locations with unsuccessful detections and the ones discarded during the pairing process) in Algorithm 1 to construct a complete pairing setting χ.
In the following discussion, we consider the case that Alice and Bob choose a specific fixed pairing setting χ. Since the following decoy-state estimation methods holds for all pairing settings χ from X, it can also be applied to the pairing setting χ chosen by the pairing strategy based on C. A detailed discussion on the security of mode-pairing scheme with a pairing setting χ chosen based on Charlie's announcement C can be found in Supplementary Note 2 D.
Let us first study the source property under a pairing setting χ. Alice and Bob pair two locations, i and j, based on χ as one round of QKD. The intensity vector of the (i, j) pair is denoted as where µ a i , µ a j , µ b i , µ b j ∈ {0, ν, µ} and hence µ a i + µ a j , µ b i + µ b j ∈ {0, ν, µ, 2ν, µ + ν, 2µ}. The probability of Alice and Bob sending out intensities µ for the (i, j) pair can be derived from the single-round probabilities as which is independent of the pairing strategy.
In the entanglement-based mode-pairing scheme presented in Supplementary Note 2, for each pair of locations (i, j), Alice is able to perform the overall-photon-number measurement on the systemsÃ i andÃ j , respectively. We denote the photon-number measurement result to be k a . Likewise, Bob can also perform the photon-number measurement onB i andB j and obtain k b . Let k denote the photon numbers (k a , k b ) on the (i, j) pair. Given the intensity setting µ on the (i, j) pair, the probability for Alice and Bob's photon-number measurement result to be k = (k a , k b ) is given by which is a product of two Poisson distributions, since the intensity settings of Alice and Bob are independent.
In the above description, Alice and Bob first choose the intensity setting µ with probability q µ and then measure the ancillary systems to obtain the photon number k with probability Pr( k| µ). From another viewpoint, the conditional probability of the intensity setting being µ if Alice and Bob measure the photon number on (i, j)-pair and obtain the result k is given by where the summation of µ = (µ a , µ b ) takes over all possible source-intensity settings. The conditional probability Pr( µ| k) reflects an intrinsic property of the source, which is independent of the specific pairing setting χ. We remark that, the probabilities Pr( k| µ), q µ and Pr( µ| k) in Eq. (54) and (55) are a prior probability distributions without the post-selection of the emitted pulses based on Charlie's announcement C. Now, let us investigate the detection side. For an (i, j) pair, Alice and Bob determine the bases and raw key bits based on the encoded intensities and phases. If the intensity vector µ satisfies then it is a Z-pair. Below, we mainly consider decoy-state estimation in the Z basis, but the analysis for X-basis estimation is similar. After mode pairing and sifting, Alice and Bob obtain M rounds of Z-pairs with successful detections; of these, E rounds are erroneous. Let M µ denote the number of rounds detected with intensity setting µ, among which E µ rounds are wrongly detected. Let the total and erroneous numbers of rounds with photon numbers k be denoted by M k and E k , respectively, among which M µ k and E µ k are the rounds with intensity setting µ. We have the following relations, In the entire QKD process, the values {M µ , E µ } µ are known to Alice and Bob. The values {M k and E k } k , however, are unknown to them but are fixed after Charlie's announcement. We remark that, no matter what the intensity setting µ is, if Alice and Bob measures the photon number on the ancillary systems and obtain the result k, the post-selected state is independent of the intensity setting. As a result, conditional on Alice and Bob's specific photon-number measurement result k, Charlie's announcement strategy is independent of the intensity setting µ. This is an alternative description of the basic assumption that the original decoy-state method makes in its security proof [10].
Based on this property, in all the generated Z-pairs with the photon-number measurement result to be k, the expected ratio of different intensity settings should be the same as the ratio of the emitted states, where the approximation is due to statistical fluctuation. In the limit of infinite data size, the approximation becomes an equality. In our experiment, we assume that Alice and Bob randomly determine the intensity µ at each location by measuring an ancillary system. Measurement results are used to classically control the intensity of the signals to Charlie. In practice, Alice and Bob first measure the overall photon number and obtain k. In this case, the intensity choice is determined only by k, independent of Charlie's announcement. Among the M k pairs with photon number k, the number of pairs with an intensity setting µ is a variable M µ k that is determined by Alice and Bob's ancillary systems. The expected ratio of the intensity setting µ is given by where the expectation value is taken for the random variable M µ k characterising Alice and Bob's intensity settings.
Similarly, for erroneous detection among the E k pairs with k photon numbers, E µ k is the variable for describing the number of pairs with intensity setting µ, From Eqs. (59) and (60), we have, Let the composite variables M µ and E µ denote the overall numbers of pairs with intensity settings µ, From Eqs. (61) and (62), we have To summarise, decoy-state analysis can be formulated as follows.
where µ ∈ {0, ν, µ} ⊗2 , k ∈ Z ⊗2 + and Z + = {0, 1, 2, ...} is the set of natural numbers. Denote the results for these two programmes as M L (1,1) and E U (1,1) , respectively. Here, we explain why Alice and Bob can use the Chernoff bound for independent variables in Step 2 and 4. As we mentioned before Eq. (58), when the photon number k on the pair of location is given, the intensity µ for each pair of locations is determined merely by the conditional probability Pr( µ| k) in Eq. (61). As a result, the intensity choices in different pair of locations are independent when the photon number k of the pairs are given. Moreover, when the emitted state in each round is identical, the intensity choices in different pairs of locations are also identical. To be more clear, we consider all the M k clicked pairs for the pairs with specific measured photon number k. If Alice and Bob check the intensity label µ on these pairs, and treat these intensity labels as random variables, then these varibles are i.i.d.,ˆ µ i = µ, with probability Pr( µ| k). (i = 1, 2, ..., M k ) (66) Here, the value of the conditional probability Pr( µ| k) only depends on the property of the source. In this case, Alice and Bob can evaluate the real number of pairs M µ k from its expectation value M k Pr( µ| k) using Chernoff bound of independent variables (Step 4 in the decoy estimation procedure above, cf. Eq. (33) in Ref. [11]); on the other hand, if Alice and Bob were awared of the photon number measurement results on the pairs, they can infer the expectation value from the real number of pairs M µ k by the inverse Chernoff bound (Step 2 in the decoy estimation procedure above, cf. Eq. (30) in Ref. [11]).
In the practical Step 2, however, Alice and Bob do not have the photon numer measurement results on the pairs. As an alternative way, instead of solving the inverse Chernoff problem for each photon number setting k, they can combine the estimation problems together: to infer the expectation value of M µ := k M µ k based on the observed value of M µ . When the underlying values the photon numbers k for each pair of locations are determined, the intensity variablesˆ µ i are independent, following Eq. (66), regardless of the photon number k. For different k, however, the variablesˆ µ i are not identical anymore, as the conditional probabilities Pr( µ| k) differ. In this case, we can still apply the inverse Chernoff bound for the independent variables.
We have introduced the decoy-state procedure for the Z-basis. Likewise, Alice and Bob can perform decoy-state analysis for the sifted X-basis obtain the single-photon-pair numbers M X,L (1,1) and E X,U (1,1) for successful and erroneous detection, respectively. Let M The relationship between Q µ and Y * k is, where Pr( k| µ) is the product of two Poisson distributions, given by Eq. (54). In this way, one can directly apply the traditional decoy-state formulas for MDI-QKD as a solution to the linear-programming problems [13,14]. Note that the value of N p will not affect the correctness of Eq. (70). If we redefine N p as N p = cN p , then the defined gain and yield will become 1 c Q µ and 1 c Y * k , respectively. From Eq. (69), we can see that the final estimated value M k is invariant only if the experimental data {M µ } are unchanged.

Supplementary Note 4. SIMULATION FORMULAS
Here, we list the formulas used for key-rate simulation of different QKD schemes. In Supplementary Note 4 A, we derive the simulation formula for the free-round MP scheme with maximal pairing length l. In a similar fashion, we derive the simulation formula for the time-bin MDI-QKD scheme in Supplementary Note 4 B. Finally, in Supplementary Note 4 C, we list the simulation formulas used in the main text for the decoy-BB84 and PM-QKD schemes.

A. Mode-pairing scheme
The key rate of the MP scheme can be calculated using Eqs. (71), (72), (74), (79), (83), (84) and (85) below. In the MP scheme, Alice and Bob use the Z-basis to generate keys. In the asymptotic case, we assume that Alice and Bob choose to randomly emit signals with intensity {0, µ} with a probability of nearly 1/2 and a decoy intensity ν with negligible probability. Let us express the coherent pulse emitted by Alice in the i-th round as | z a i µ exp(iφ a i ) , with z a i ∈ {0, 1} being a random variable indicating the intensity and φ a i being a random phase. Similarly, Bob emits | z b i µ exp(iφ b i ) in the i-th round. The i-th round intensity setting is then denoted by a 2-bit vector z i := [z a i , z b i ]. In the simulation, Alice and Bob are assumed to emit pulses to Charlie through a typical symmetric-loss channel. The single-side transmittance of the channel (with included detection efficiency η d included) is η s , and the dark count of each detector is p d . The simulation data is provided in Supplementary Figure 4 in the main text. In this case, the channel is i.i.d. for each round. Alice and Bob then pair the clicked pulses and set their bases. For the (i, j)-th pulses to be paired, let , where ⊕ is the bit-wise addition modulo 2. When τ i,j = [1, 1], the (i, j)-pair is then set to be a signal pair.
The key rate of the MP scheme is expressed as where l is the maximal pairing gap, r p (p, l) is the expected pair number generated during each round, and r s is the probability that a clicked pulse pair is a signal pair,q 11 and e X (1,1) are, respectively, the expected single-photon pair ratio in all signal pairs and the phase error of the single-photon pairs, which are estimated via decoy-state methods. f is the error-correction efficiency, E Z (µ,µ) is the bit-error rate of the signal pairs and p is the probability of the i-th signal to be successfully clicked (as defined in Eq. (74)). The value of r p (p, l) has already been given in the Methods as Here, we first consider the calculation of r s ,q 11 and E Z (µ,µ) . In the i-th round, we denote the click events of the left and right detectors at the i-th turn by two variables (L i , R i ). The successful click variable is C i = L i ⊕ R i . Only when C i = 1 does an successful click occur. The detection probability Pr(C i = 1|z i ) is given by The expected click probability, i.e., the total transmittance of each round, is The pairing rate r p (p, l) can then be calculated using Eq. (72). The phase-randomised coherent states emitted in the i-th round can also be regarded as the mixture of photonnumber states. Pr(C i = 1|n i ) denotes the detection probability when Alice and Bob emit photon-number states |n a i and |n b i , respectively; it is given by Now, let us calculate the signal-pair ratio r s . Without loss of generality, we consider the i-th and j-th turns as a paired group. For a general turn, the probability of a click caused by the intensity setting z is Note that the subscript is omitted, since the detections in all rounds are identical and independently distributed in our simulation. In the MP scheme, an successful click happens when τ i,j = [1,1]. Therefore, four possible configurations of z i and z j (which generate signal pairs) are The signal-pair ratio r s is then We remark that, when η s µ 1, the signal-pair ratio r s is approximately which is nearly a constant independent of η s and µ.
The expected error rate E Z (µ,µ) of the (i, j)-pair is Note that the erroneous pair condition is contained in the effective pair condition. The erroneous probability is given by Therefore, Then, we calculate the expected single-photon pair ratioq 11 in the effective signal-pairs: where P µ (k) = exp(−µ) µ k k! is the Poisson distribution and Pr(C i = 1|n i ) is defined in Eq. (75). The phase-error rate formula of the MP scheme cannot be calculated for single-pulse-based methods. In the MP scheme, if the decoy-state estimation is perfect, then the phase-error rate should be the same as that of the original two-mode MDI-QKD scheme. Here, we apply the formulas (A9) and (A11) in Ref. [6]: Here, e 0 = 1/2 is the error caused by vacuum signals, e d is the pre-set misalignment error, and η a (η b ) are the transmittances from Alice (Bob) to Charlie. In our case, η a = η b = η s . In the MP scheme and the normal two-mode MDI-QKD schemes, since there is no common phase reference between Alice and Bob, the X-basis detection results for coherent states will have an intrinsic 25% error rate in E X µµ , as is shown in Eq. (B15) in Ref. [6]. Fortunately, if we can perform an accurate decoy-state estimation, we can estimate single-photon error rate e X 11 accurately without this 25% effect.

B. Time-bin MDI-QKD
The key rate of time-bin MDI-QKD is calculated as Eqs. (86), (91), (92), (93), and (94) below. The time-bin MDI-QKD scheme can be regarded as a special case of the MP scheme with fixed-pairing setting and a predetermined effective-intensity setting [z i , z j ] at locations i and j. That is, if the pairs are clicked, then the pair is effective with z i ⊕ z j = 11. The derivation of the simulation formulas for time-bin MDI-QKD is similar to that of the MP scheme in Supplementary Note 4 A.
In the time-bin MDI-QKD scheme, Alice and Bob use the Z-basis to generate keys. In the asymptotic case, we assume that they choose to emit the X-basis state with a negligible probability, such that the basis-sifting factor is almost 1. The key rate of the time-bin MDI-QKD scheme is where the factor 1 2 is for a comparison with the MP scheme, since the key-rate formula of R M DI is defined on a pair of rounds while the key-rate formula Eq. (71) for the MP scheme is defined on each round. Q µµ is the probability of the pair with successful detection. The parametersq 11 , e X (1,1) and E Z (µ,µ) are similar to those in the MP scheme. Similar to Supplementary Note 4 A, we also introduce z i = [ζ a i , z b i ] and C i to denote the intensity setting of the i-th location and detection results, respectively. The single-location detection probability of a given z i is the same as that in the MP scheme, Meanwhile, we introduce n i = [n a i , n b i ] to denote the emitted photon number at the i-th location. The conditional detection probability Pr(C i = 1|n i ) is still given by In time-bin MDI-QKD and for a fixed pair of locations i and j, the configurations of z i and z j are predetermined to be chosen in the set By definition we have The quantum bit-error rate E Z (µ,µ) , is The ratio of the single-photon pairs in the signals with successful detectionq 11 is q 11 = Pr(S|C) = Pr(S, C) Pr(C) where P µ (k) = exp(−µ) µ k k! is the Poisson distribution and Pr(C i = 1|n i ) is defined in Eq. (88). The phase-error-rate formula of time-bin MDI-QKD is given by the formulas (A9) and (A11) in Ref. [6], Here, e 0 = 1/2 is the error caused by vacuum signals, e d is the pre-set misalignment error, and η a (η b ) are the transmittances from Alice (Bob) to Charlie. In our case, η a = η b = η s .

C. Other QKD schemes
Here, we list the simulation formulas for decoy-state BB84 and PM-QKD which are used in the key rate simulation programme. We also list the repeaterless rate-transmittance bound drawn in the main text.
The key rate of the decoy-state BB84 scheme is [10] Here, for a fair comparison with the time-bin MDI-QKD and the MP scheme, we consider a time-bin encoding BB84 scheme, where Alice's Z-basis encoding is undertaken by choosing to emit a phase-randomised coherent state in one of two time-bin optical modes. In this case, the Z-basis bit error is merely caused by the dark counts, regardless of the misalignment error. We now consider an efficient basis choice with a sifting factor of 1. For a fair comparison, we multiply the original key rate of decoy-state BB84 by a factor of 1/2. The reason is that we are considering the averaged key rate generated by each pair of optical modes, A i and B i , while the key rate for the original decoy-state BB84 is found for each round in which Alice (and Bob) emit two optical modes. In the simulation, the yield and error rates of the k-photon component in the X-basis are [15] where e d is the intrinsic misalignment-error rate caused by a phase-reference mismatch. The gain and QBER of the Z-basis pulse are given by where Y 0 = 2p d and e 0 = 1/2.
For PM-QKD, the key-rate formula is [2,16], where D = 16 is the number of slices. The gain, yield and error rates are where e P M d is the intrinsic misalignment error of the PM-QKD. We take these formulas from Eqs. (8)- (12) and (D1)-(D4) in Ref. [2].
For SNS-TF-QKD, the key-rate formula is [17,18], where p z0 is Alice's (or Bob's) probability of sending vaccum state, µ z is the light intensity for Alice or Bob's signal pulses, s 1 is the detecting probability of single-photon signals, e ph 1 is the single-photon phase error rate, S z is the detecting probability of signal lights and E Z is the quantum bit error rate. p z0 and µ z need to be optimized. We use the following simulation formula, matching the results in Ref. [18], Here, e SN S d is the misalignment error. S 00 , S 02 , and S 22 indicate the detecting probabilities of the signals when Alice and Bob emit light with intensity (0, 0), (0, µ z ), and (µ z , µ z ), respectively, which are given by the following formulas, where I 0 (x) is the modified Bessel function of the first kind.

Supplementary Note 5. ADDITIONAL NUMERICAL RESULTS
To further understand the key rate property of the MP scheme, we simulate this scheme's optimal intensity settings, as well as those of the other schemes mentioned in the main text. We choose exactly the same simulation parameters as used in Fig. 4  Supplementary Figure 20. Comparison of the optimal intensity settings of different QKD schemes. Here, all the simulation parameters are chosen to be the same as those in Fig. 4 in the main text. Here, the optimal µ for the BB84 scheme is defined to be the overall intensity of two emitted modes in each round. The optimal µ value for (two-mode) MDI-QKD is defined as the overall intensity of Alice's (or Bob's) two emitted modes in each round. The optimal µ values for MP-QKD, PM-QKD, and SNS-TFQKD are defined on each single round.

Supplementary Note 6. PROOF-OF PRINCIPLE EXPERIMENTAL DEMONSTRATION
In the mode-pairing scheme, like other phase-encoding QKD schemes, certain "local phase stabilization" is still required. In this section, we want to clarify the difference between this local phase stabilization and the "global phase locking" over two remote independent lasers required for the one-mode MDI-QKD schemes.
Suppose Alice and Bob hold two independent lasers emitting the optical pulses independently. One can track the phases of these coherent state pulses. For the pulses emitted by Alice and Bob at the time t, denote the global phases of the pulses as φ a (t) and φ b (t), respectively. Generally, the circular frequencies of Alice's and Bob's lasers, ω a (t) and ω b (t), are changing over time. We model the phases φ a (t) and φ b (t) as follows, where ψ a (t) and ψ b (t) are two randomly fluctuated noise terms with a rate much slower than the one caused by circular frequencies and independent of ω a and ω b . Here, the phase fluctuation caused by fibres is normally slow, based on the former experimental result. When the fibre length is around 500 km, the phase drift velocity is less than 10 rad/ms [21]. Then, we define global phase locking and local phase stabilization as following.
Definition 6 (Global phase locking). After Alice and Bob perform global phase locking, they can achieve either of the following two tasks during the whole process of the experiment.
• They keep the relative phase between the two emitted pulses φ b (t) − φ a (t) to be a constant, independent of the time t.
• They are able to estimate the phase difference φ b (t) − φ a (t) for every moment t accurately.
If we want to perform global phase locking, we have to stabilize the phase difference φ b (t) − φ a (t) for each moment t or accurately estimate it. Due to the large frequency difference ω b (t) − ω a (t) of two independent lasers, the value of φ b (t) − φ a (t) changes rapidly with respect to t, making the stabilization or accurate estimation of φ b (t) − φ a (t) challenging.
Definition 7 (Local phase stabilization). After Alice and Bob perform local phase locking, they can achieve either of the following two tasks for any two moments t 1 and t 2 , satisfying |t 1 − t 2 | ≤ ∆t, • Alice keeps the relative phase between her two emitted pulses φ a (t 2 ) − φ a (t 1 ) to be a constant, independent of t 1 and t 2 . Bob does the same thing for φ b (t 2 ) − φ b (t 1 ).
We remark that, the core difference of the local phase stabilization from the global phase locking is to estimate the difference of the phase φ b (t) − φ a (t) between two moments t 1 and t 2 instead of estimating the phase itself. We now discuss why this task will be easier than the global phase locking for a reasonable time period ∆t = t 2 − t 1 .
In the task of local phase stabilization, the users try to stabilize 112) within time ∆t = t 2 − t 1 . For a short time period ∆t, ψ a (t 2 ) − ψ a (t 1 ) and ψ b (t 2 ) − ψ b (t 1 ) will be relatively small. To estimate the value of θ δ (t 1 , t 2 ) in a short period ∆t, Alice and Bob only need to track the frequency difference ω b (t) − ω a (t), which is easier than directly measure the phase difference φ b (t) − φ a (t). Then, they use the integration t2 t1 [ω b (t) − ω a (t)]dt to estimate the phase difference θ δ (t 1 , t 2 ). On the other hand, when the time period ∆t gets longer, the accuracy of integration t2 t1 [ω b (t) − ω a (t)]dt will be affected, and the slow phase fluctuation ψ a (t 2 ) − ψ a (t 1 ) and ψ b (t 2 )−ψ b (t 1 ) would come into play, which would affect the final results of local phase stabilization. The hardness of local phase stabilization requirement depends on the time interval ∆t. We now consider the following two extreme cases.
1. When ∆t = t 2 − t 1 1/∆f , where ∆f is the laser linwidth. For example, in the regular phase-encoding MDI-QKD, the ∆t of local phase stabilization requirement is the time between two adjacent pulses, which is usually in this scenario. In this case, the values of ω b (t) − ω a (t) is stable, and the value of ψ a (t 2 ) − ψ a (t 1 ) and ψ b (t 2 ) − ψ b (t 1 ) will be close to zero. As a result, the local phase stabilization is easy to realize.
2. When ∆t = t 2 − t 1 1/∆f . Then, the frequency difference ω b (t) − ω a (t) fluctuates randomly, and the values of ψ a (t 2 ) − ψ a (t 1 ) and ψ b (t 2 ) − ψ b (t 1 ) become large. To fulfill the requirements in Definition 7, we have to estimate both the phases φ b (t 1 ) − φ a (t 1 ) and φ b (t 2 ) − φ a (t 2 ) accurately. In this case, the local phase stabilization approaches the case of global phase locking.
In order to show the feasibility of realizing the local phase stabilization in Definition 7 with a reasonable large time period ∆t, we perform an experimental demonstration using two independent lasers. This is the essentially the same setup as the phase-matching experiment [21], except for the removal of the strong master laser for global phase-locking. Alice and Bob each use a laser with the central frequency of ω a ≈ ω b ≈ 193.533 THz. The linewidth ∆f of the lasers is 2 kHz. The frequency difference of two lasers is about 30 MHz, which is much larger than the linewidth. The system frequency is 625 MHz.
In the experiment, Alice and Bob both send laser pulses of intensity µ to a measurement site in the middle. Depending on the transmission distance, they will choose a proper µ such that they will get a suitable number of detection results. Besides, they do not perform any phase modulation on these pulses for simplicity. The coherent state prepared by Alice and Bob can be denoted as | √ µe iφ a (t) and | √ µe iφ b (t) , respectively. The two pulses are interfered at the measurement site and then are detected by single-photon detectors. The detection result is "L" if one of the detectors clicks, and "R" if the other detector clicks. Now, they do not apply any phase-locking techniques in the demonstration, it is very challenging to track the global phases and predict the measurement result in single round. However, in mode-pairing scheme, we only care about whether the measurement results of the two paired locations are the same or not. Which is determined by the phase difference betweem two paired locations i and j, where ω δ (t) := ω b (t) − ω a (t) is the frequency difference between Alice's and Bob's laser pulses. For a short period of time, we can assume that ω δ (t) drifts with a linear model, After accumulating enough detection results, Alice and Bob can use them to estimate the frequency difference of their lasers during data post-processing. First, they pair the locations where the successful detection occurs. For a pair, there are four possible detection results, (L, R), (R, L), (L, L) and (R, R). One click on location i and the other on j.
With the paired locations and corresponding detection results, Alice and Bob can estimate ω δ (t) using a probabilistic model corresponding to this optical setting. Then they can calculate the phase difference θ δ using Eq. (113).
To test the accuracy of the estimation of ω δ (t) in Eq. (114), we further use the estimated θ δ to predict the detection results. When the estimated value of θ δ of a pair is in the region [−∆/2, +∆/2) or [π − ∆/2, π + ∆/2), this data pair can be further used for testing. Here, ∆ = 2π/32 is the width of the phase slice. In the former case, Alice and Bob assign the detection (L, R) or (R, L) to be error and (L, L) or (R, R) to be correct; while in the latter case, they assign the detection (L, L) or (R, R) to be error and (L, R) or (R, L) to be correct.
Below we draw the error rate of the paired strong pulses with respect to different pairing length l = j − i. We group the paired locations by different pairing length, as shown in Supplementary Figure 22. This error rate can reflect the X-basis error rate in mode-pairing QKD. Similar to the phase-encoding MDI-QKD, the X-basis error has a 25% intrinsic error rate caused by the multi-photon components in the coherent states. From the demonstration we can see that, apart from the intrinsic error, our method only introduces a reasonable additional error rate. One can further reduce the error rate by post-selecting the good signals in post-processing of reference pulses. If we use the decoy method to estimate the phase error in a single photon pair, the error rate will be a reasonable value that we can obtain a positive final key rate. Therefore, the mode-pairing scheme is feasible without global phase locking. From Supplementary Figure 22, we can see that the error rate is stable when the pairing length is up to 3000 ∼ 4000. If we further enhance the system frequency to 4 GHz [22], we are able to achieve a maximal pairing length of 20000. In this way, the performance of the mode-pairing scheme can surpass the repeaterless key-rate bound. We leave a full demonstration of the mode-pairing scheme for future works.